Voice over Internet Protocol (“VoIP”) is the technology of choice in voice communications, whether as green-field deployment or as upgrade to existing Time Division Multiplex (“TDM”) networks, because of its demonstrated efficiencies and potential for productivity improvements. Security measures to ward off the new and unique threats arising from VoIP have largely been ignored in the race to get VoIP technologies to both wired and wireless environments. Voice Spam, Voice Mail Spam, stealth Denial of Service (“DoS”) (low frequency but constant calls to the same number) are all examples of heretofore unknown problems that can completely disable any or all user devices and services, as well as the entire VoIP system itself. As has happened with email, once IP telephone calls can originate from anyplace in the world, at a near zero cost per call, such threats could impact anyone, anywhere.
Dealing with both internal and external threats to secure data networks from DoS, Distributed DoS (“DDoS”), and SPAM is well known to the data world. In voice networks, however, these same threats have significantly amplified impacts because the telephone and its related services are personal, real-time, and interactive. Imagine a phone ringing regularly in the middle of the night because of a spammer, or all phones in an enterprise ringing constantly due to a DoS attack, or entire voice mail systems being completely filled overnight with SPAM (and then each individual having to clear out their voice mailbox manually in the morning).
Meanwhile, the deployment of VoIP in enterprises, wireline carrier and wireless carrier networks is exploding. Extensive VoIP deployment is imminent in wireless networks as well (e.g., Unlicensed Mobile Access (“UMA”) networks). “Dual Mode” mobile phones are now providing voice services using VoIP over WiFi when available, and cellular elsewhere. These Dual Mode phones combine the better in-building coverage and reduced cost of WiFi hotspots with the broad geographic reach of cellular. Further, as the mobile phones are upgraded to the IP Multimedia Subsystem (“IMS”) standard, VoIP shall be ubiquitously used even over the wide area cellular networks.
The newest and soon to be ubiquitous VoIP, Video & Multimedia standard is the Session Initiation Protocol (“SIP”). In addition to SIP-based desk phones, SIP-based soft-phones are being incorporated into personal computers (“PCs”), Laptops, personal data assistants (“PDAs”), and Smart-phones (IMS). All of these VoIP communications systems, SIP, IMA and UMA, are all vulnerable to inappropriate VoIP signaling and/or media streams that can attack an individual or an entire enterprise. Current security management products for VoIP, although necessary and effective for what they do, cannot provide the needed functionality to stop VoIP specific attacks like Stealth DoS, Stealth DDoS, and Voice/Voice Mail Spam.
Stealth DoS attacks can include repeated but low-frequency calls to the same number. Unseen by Firewalls, just one or two calls a minute are enough to take an endpoint out-of-service. Much more troublesome are DDoS attacks. The first difficulty is determining that a DDoS attack is actually underway; the second is pinpointing the many sources. Both DoS and DDoS get much more difficult when the attacker hides by “spoofing” their IP address or caller ID, or if they use “zombies” to launch their attacks. Zombies are devices that have been taken over by the attacker, usually without end user knowledge. Targeted Stealth DoS and DDoS attacks can easily make it impossible for an enterprise to conduct business. The impacts to the enterprise could range from a few phones out of services, up to and including being completely out of business for some period of time. If that enterprise instead of owning/operating its own IP PBX were using hosted IP Centrex services provided by an Internet Telephony Service Provider (“ITSP”), the impact to the serving ITSP as well could be far beyond having to pay penalties for violating the SLA.
There is also the emerging problem of Voice and Voice Mail Spam. Because the incremental cost of launching such attacks approaches zero with VoIP, the situation could become as it is today where the majority of email traffic is spam. Actually, compared to email, Voice Spam is much more costly for both individuals and the enterprise, since it has to be dealt with in real-time, either by actually answering the unwanted call (which may not even be a call at all), or by sifting through all of one's voice mails to see which if any are indeed real. It even gets trickier because legitimate telemarketers are shifting to VoIP (Do Not Call lists are unenforceable in a VoIP), and since some individuals respond positively to such telemarketing, what is defined as Spam for one person may be acceptable to another. Further compounding the impact on both individuals and corporations, Voice Mail storage is costly and limited. A fairly simple attack scenario could be used to fill up the entire Voice Mail system of an enterprise so that every single employee would have to clear out their Voice Mail boxes before they could receive any legitimate ones, not to mention whatever messages callers were unable to leave in the meantime because the Voice Mail box capacity had been maxed out.
Certainly, repeated episodes of DoS, DDoS or Voice Spam, or perhaps even merely continued fears of such attacks by customers, trading partners and employees, could easily cause a dramatic reduction in an organization's ability to conduct business. In this circumstance, telecom vendors should expect most enterprises and consumers to take their business elsewhere. In some jurisdictions, local, state and federal government customers may even be forced by law to move to a new provider. Alternatively, and with equally devastating impacts, entire blocks of VoIP phones could be attacked, so that large subnets could effectively be rendered useless. Again, the subsequent business impact and loss of competitive positioning to impacted enterprise as well as the underlying VoIP vendors would be severe.
Accordingly, there is a need for a system, method and apparatus for providing security in VoIP communication systems (e.g., SIP, IMS, UMA, etc.) and is capable of preventing the unauthorized use of the VoIP network, protecting the privacy of the VoIP users, protecting the VoIP network infrastructure assets and VoIP endpoints from various VoIP specific DoS attacks ranging from simple, brute force Flood DoS attacks to highly sophisticated, zombie, spoofing and malicious user driven DDoS, Stealth DoS, Blended attacks, Day-zero attacks and VoIP SPAM.